treewide: Make explicit that 'dev' output of openssl is used

nixos/modules/system/boot/luksroot.nix

@@ -438,7 +438,7 @@ in
         copy_bin_and_libs ${pkgs.ykpers}/bin/ykinfo
         copy_bin_and_libs ${pkgs.openssl.bin}/bin/openssl
 
-        cc -O3 -I${pkgs.openssl}/include -L${pkgs.openssl.out}/lib ${./pbkdf2-sha512.c} -o pbkdf2-sha512 -lcrypto
+        cc -O3 -I${pkgs.openssl.dev}/include -L${pkgs.openssl.out}/lib ${./pbkdf2-sha512.c} -o pbkdf2-sha512 -lcrypto
         strip -s pbkdf2-sha512
         copy_bin_and_libs pbkdf2-sha512
 

pkgs/applications/misc/fetchmail/default.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ openssl ];
 
-  configureFlags = "--with-ssl=${openssl}";
+  configureFlags = "--with-ssl=${openssl.dev}";
 
   meta = {
     homepage = "http://www.fetchmail.info/";

pkgs/applications/networking/browsers/elinks/default.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
       --enable-finger --enable-html-highlight
       --with-perl --enable-gopher --enable-cgi --enable-bittorrent
       --with-spidermonkey=${spidermonkey}
-      --enable-nntp --with-openssl=${openssl}
+      --enable-nntp --with-openssl=${openssl.dev}
     '' + stdenv.lib.optionalString enableGuile " --with-guile"
     + stdenv.lib.optionalString enablePython " --with-python";
 

pkgs/applications/networking/browsers/lynx/default.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   };
   
   configureFlags = []
-    ++ stdenv.lib.optionals sslSupport [ "--with-ssl=${openssl}" ];
+    ++ stdenv.lib.optionals sslSupport [ "--with-ssl=${openssl.dev}" ];
   
   buildInputs = [ ncurses gzip ];
   nativeBuildInputs = [ ncurses ];

pkgs/applications/networking/browsers/w3m/default.nix

@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     ln -s $out/libexec/w3m/w3mimgdisplay $out/bin
   '';
 
-  configureFlags = "--with-ssl=${openssl} --with-gc=${boehmgc.dev}"
+  configureFlags = "--with-ssl=${openssl.dev} --with-gc=${boehmgc.dev}"
     + optionalString graphicsSupport " --enable-image=${optionalString x11Support "x11,"}fb";
 
   preConfigure = ''

pkgs/applications/networking/cluster/mesos/default.nix

@@ -102,7 +102,7 @@ in stdenv.mkDerivation rec {
     "--enable-optimize"
     "--disable-python-dependency-install"
     "--enable-ssl"
-    "--with-ssl=${openssl}"
+    "--with-ssl=${openssl.dev}"
     "--enable-libevent"
     "--with-libevent=${libevent.dev}"
   ] ++ lib.optionals stdenv.isLinux [

pkgs/applications/networking/instant-messengers/centerim/default.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl curl ncurses libjpeg ]
     ++ stdenv.lib.optional withGpg gpgme;
 
-  configureFlags = [ "--with-openssl=${openssl}" ];
+  configureFlags = [ "--with-openssl=${openssl.dev}" ];
 
   meta = {
     homepage = http://www.centerim.org/;

pkgs/applications/networking/instant-messengers/mcabber/default.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ openssl ncurses pkgconfig glib loudmouth libotr gpgme ];
 
-  configureFlags = "--with-openssl=${openssl} --enable-modules --enable-otr";
+  configureFlags = "--with-openssl=${openssl.dev} --enable-modules --enable-otr";
 
   doCheck = true;
   

pkgs/applications/networking/irc/wraith/default.nix

@@ -16,7 +16,7 @@ mkDerivation rec {
     substituteInPlace src/libssl.cc    --subst-var-by openssl ${openssl}
     substituteInPlace src/libcrypto.cc --subst-var-by openssl ${openssl}
   '';
-  configureFlags = "--with-openssl=${openssl}";
+  configureFlags = "--with-openssl=${openssl.dev}";
   installPhase = ''
     mkdir -p $out/bin
     cp -a wraith $out/bin/wraith

pkgs/applications/networking/mailreaders/alpine/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     inherit (s) url sha256;
   };
   configureFlags = [
-    "--with-ssl-include-dir=${openssl}/include/openssl"
+    "--with-ssl-include-dir=${openssl.dev}/include/openssl"
     "--with-tcl-lib=${tcl.libPrefix}"
     ];
   preConfigure = ''

pkgs/applications/networking/mailreaders/realpine/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation {
     inherit (s) url sha256;
   };
   configureFlags = [
-    "--with-ssl-include-dir=${openssl}/include/openssl"
+    "--with-ssl-include-dir=${openssl.dev}/include/openssl"
     "--with-tcl-lib=${tcl.libPrefix}"
     ];
   preConfigure = ''

pkgs/applications/networking/newsreaders/slrn/default.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation {
       -e "s|/bin/rm|rm|"
   '';
 
-  configureFlags = "--with-slang=${slang} --with-ssl=${openssl}";
+  configureFlags = "--with-slang=${slang} --with-ssl=${openssl.dev}";
 
   buildInputs = [ slang ncurses openssl ];
 

pkgs/applications/networking/remote/rdesktop/default.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation (rec {
   buildInputs = [openssl libX11];
 
   configureFlags = [
-    "--with-openssl=${openssl}"
+    "--with-openssl=${openssl.dev}"
     "--disable-credssp"
     "--disable-smartcard"
   ];

pkgs/development/compilers/urweb/default.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     sed -e 's@/usr/bin/file@${file}/bin/file@g' -i configure
   '';
 
-  configureFlags = "--with-openssl=${openssl}";
+  configureFlags = "--with-openssl=${openssl.dev}";
 
   preConfigure = ''
     export PGHEADER="${postgresql}/include/libpq-fe.h";

pkgs/development/interpreters/erlang/R16.nix

@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     sed -e s@/bin/pwd@pwd@g -i otp_build
   '';
 
-  configureFlags= "--with-ssl=${openssl} ${optionalString odbcSupport "--with-odbc=${unixODBC}"} ${optionalString stdenv.isDarwin "--enable-darwin-64bit"}";
+  configureFlags= "--with-ssl=${openssl.dev} ${optionalString odbcSupport "--with-odbc=${unixODBC}"} ${optionalString stdenv.isDarwin "--enable-darwin-64bit"}";
 
   postInstall = let
     manpages = fetchurl {

pkgs/development/interpreters/erlang/R17.nix

@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   '';
 
   configureFlags= [
-    "--with-ssl=${openssl}"
+    "--with-ssl=${openssl.dev}"
   ] ++ optional enableHipe "--enable-hipe"
     ++ optional wxSupport "--enable-wx"
     ++ optional odbcSupport "--with-odbc=${unixODBC}"

pkgs/development/interpreters/erlang/R18.nix

@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   '';
 
   configureFlags= [
-    "--with-ssl=${openssl}"
+    "--with-ssl=${openssl.dev}"
   ] ++ optional enableHipe "--enable-hipe"
     ++ optional wxSupport "--enable-wx"
     ++ optional odbcSupport "--with-odbc=${unixODBC}"

pkgs/development/libraries/apr-util/default.nix

@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-apr=${apr.dev}" "--with-expat=${expat.dev}" ]
     ++ optional (!stdenv.isCygwin) "--with-crypto"
-    ++ optional sslSupport "--with-openssl=${openssl}"
+    ++ optional sslSupport "--with-openssl=${openssl.dev}"
     ++ optional bdbSupport "--with-berkeley-db=${db}"
     ++ optional ldapSupport "--with-ldap=ldap"
     ++ optionals stdenv.isCygwin

pkgs/development/libraries/cyrus-sasl/default.nix

@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     );
 
   configureFlags = [
-    "--with-openssl=${openssl}"
+    "--with-openssl=${openssl.dev}"
   ];
 
   # Set this variable at build-time to make sure $out can be evaluated.

pkgs/development/libraries/ggz_base_libs/default.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ intltool openssl expat libgcrypt ];
 
   configureFlags = [
-    "--with-ssl-dir=${openssl}/"
+    "--with-ssl-dir=${openssl.dev}/"
     "--with-tls"
   ];
 

pkgs/development/libraries/kerberos/heimdal.nix

@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     "--enable-hdb-openldap-module"
     "--with-sqlite3=${sqlite}"
     "--with-libedit=${libedit}"
-    "--with-openssl=${openssl}"
+    "--with-openssl=${openssl.dev}"
     "--without-x"
     "--with-berkeley-db=${db}"
   ] ++ optionals (!libOnly) [

pkgs/development/libraries/ldns/default.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ perl ];
   buildInputs = [ openssl ];
 
-  configureFlags = [ "--with-ssl=${openssl}" "--with-drill" ];
+  configureFlags = [ "--with-ssl=${openssl.dev}" "--with-drill" ];
 
   meta = with stdenv.lib; {
     description = "Library with the aim of simplifying DNS programming in C";

pkgs/development/libraries/libksi/default.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl curl ];
 
   configureFlags = [
-    "--with-openssl=${openssl}"
+    "--with-openssl=${openssl.dev}"
     "--with-cafile=/etc/ssl/certs/ca-certificates.crt"
   ];
 

pkgs/development/libraries/serf/default.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildPhase = ''
-    scons PREFIX="$out" OPENSSL="${openssl}" ZLIB="${zlib}" APR="$(echo "${apr.dev}"/bin/*-config)" \
+    scons PREFIX="$out" OPENSSL="${openssl.dev}" ZLIB="${zlib}" APR="$(echo "${apr.dev}"/bin/*-config)" \
         APU="$(echo "${aprutil.dev}"/bin/*-config)" CC="${
           if stdenv.cc.isClang then "clang" else "${stdenv.cc}/bin/gcc"
         }" ${

pkgs/development/libraries/swiften/default.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   
   buildPhase = ''
     patchShebangs ./scons
-    ./scons openssl=${openssl} \
+    ./scons openssl=${openssl.dev} \
             boost_includedir=${boost.dev}/include \
             boost_libdir=${boost.out}/lib \
             boost_bundled_enable=false \

pkgs/development/r-modules/default.nix

@@ -1922,7 +1922,7 @@ let
     });
 
     openssl = old.openssl.overrideDerivation (attrs: {
-      OPENSSL_INCLUDES = "${pkgs.openssl}/include";
+      OPENSSL_INCLUDES = "${pkgs.openssl.dev}/include";
     });
 
     Rserve = old.Rserve.overrideDerivation (attrs: {

pkgs/servers/computing/slurm/default.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   configureFlags =
     [ "--with-munge=${munge}"
-      "--with-ssl=${openssl}"
+      "--with-ssl=${openssl.dev}"
     ] ++ stdenv.lib.optional (gtk == null)  "--disable-gtktest";
 
   preConfigure = ''

pkgs/servers/dns/bind/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     "--localstatedir=/var"
     "--with-libtool"
     "--with-libxml2=${libxml2}"
-    "--with-openssl=${openssl}"
+    "--with-openssl=${openssl.dev}"
     "--without-atf"
     "--without-dlopen"
     "--without-docbook-xsl"

pkgs/servers/http/apache-httpd/2.2.nix

@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     --enable-mods-shared=all
     --enable-authn-alias
     ${if proxySupport then "--enable-proxy" else ""}
-    ${if sslSupport then "--enable-ssl --with-ssl=${openssl}" else ""}
+    ${if sslSupport then "--enable-ssl --with-ssl=${openssl.dev}" else ""}
     ${if ldapSupport then "--enable-ldap --enable-authnz-ldap" else ""}
     --with-mpm=${mpm}
     --enable-cache

pkgs/servers/irc/charybdis/default.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--enable-epoll"
     "--enable-ipv6"
-    "--enable-openssl=${openssl}"
+    "--enable-openssl=${openssl.dev}"
     "--with-program-prefix=charybdis-"
   ];
 

pkgs/servers/irc/ircd-hybrid/default.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation {
   buildInputs = [ openssl zlib ];
 
   configureFlags =
-    "--with-nicklen=100 --with-topiclen=360 --enable-openssl=${openssl}";
+    "--with-nicklen=100 --with-topiclen=360 --enable-openssl=${openssl.dev}";
 
   postInstall = "echo postinstall; mkdir -p \${out}/ ; rm -rf \${out}/logs ; ln -s /home/ircd \${out}/logs;";
 

pkgs/servers/monitoring/net-snmp/default.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
       "--with-sys-contact=root@unknown"
       "--with-logfile=/var/log/net-snmpd.log"
       "--with-persistent-directory=/var/lib/net-snmp"
-      "--with-openssl=${openssl}"
+      "--with-openssl=${openssl.dev}"
     ] ++ stdenv.lib.optional stdenv.isLinux "--with-mnttab=/proc/mounts";
 
   buildInputs = [ autoreconfHook file perl unzip openssl ];

pkgs/servers/openxpki/default.nix

@@ -51,7 +51,7 @@ buildPerlPackage {
 
   preConfigure = ''
     substituteInPlace core/server/Makefile.PL \
-      --replace "my \$openssl_inc_dir = ''';" "my \$openssl_inc_dir = '${openssl}/include';" \
+      --replace "my \$openssl_inc_dir = ''';" "my \$openssl_inc_dir = '${openssl.dev}/include';" \
       --replace "my \$openssl_lib_dir = ''';" "my \$openssl_lib_dir = '${openssl.out}/lib';" \
       --replace "my \$openssl_binary  = ''';" "my \$openssl_binary  = '${openssl.bin}/bin/openssl';"
     substituteInPlace tools/vergen --replace "#!/usr/bin/perl" "#!${perl}/bin/perl"

pkgs/servers/sql/mysql/5.1.x.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--enable-thread-safe-client"
-    "--with-ssl=${openssl}"
+    "--with-ssl=${openssl.dev}"
     "--with-embedded-server"
     "--with-plugins=max-no-ndb"
     "--with-unix-socket-path=/run/mysqld/mysqld.sock"

pkgs/servers/sql/virtuoso/6.x.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   configureFlags = "
     --enable-shared --disable-all-vads --with-readline=${readline}
     --disable-hslookup --disable-wbxml2 --without-iodbc
-    --enable-openssl=${openssl}
+    --enable-openssl=${openssl.dev}
     ";
 
   postInstall=''

pkgs/servers/sql/virtuoso/7.x.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   configureFlags = "
     --enable-shared --disable-all-vads --with-readline=${readline}
     --disable-hslookup --disable-wbxml2 --without-iodbc
-    --enable-openssl=${openssl}
+    --enable-openssl=${openssl.dev}
     ";
 
   postInstall=''

pkgs/tools/backup/attic/default.nix

@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication rec {
     [ cython msgpack openssl acl llfuse ];
 
   preConfigure = ''
-    export ATTIC_OPENSSL_PREFIX="${openssl}"
+    export ATTIC_OPENSSL_PREFIX="${openssl.dev}"
     substituteInPlace setup.py --replace "version=versioneer.get_version()" "version='${version}'"
   '';
 

pkgs/tools/backup/bareos/default.nix

@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     "--enable-scsi-crypto"
   ] ++ optionals (readline != null) [ "--disable-conio" "--enable-readline" "--with-readline=${readline}" ]
     ++ optional (python != null) "--with-python=${python}"
-    ++ optional (openssl != null) "--with-openssl=${openssl}"
+    ++ optional (openssl != null) "--with-openssl=${openssl.dev}"
     ++ optional (sqlite != null) "--with-sqlite3=${sqlite}"
     ++ optional (postgresql != null) "--with-postgresql=${postgresql}"
     ++ optional (libmysql != null) "--with-mysql=${libmysql}"

pkgs/tools/backup/borg/default.nix

@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication rec {
   ]);
 
   preConfigure = ''
-    export BORG_OPENSSL_PREFIX="${openssl}"
+    export BORG_OPENSSL_PREFIX="${openssl.dev}"
     export BORG_LZ4_PREFIX="${lz4}"
   '';
 

pkgs/tools/backup/partimage/default.nix

@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     url = mirror://sourceforge/partimage/partimage-0.6.9.tar.bz2;
     sha256 = "0db6xiphk6xnlpbxraiy31c5xzj0ql6k4rfkmqzh665yyj0nqfkm";
   };
-  configureFlags = "--with-ssl-headers=${openssl}/include/openssl";
+  configureFlags = "--with-ssl-headers=${openssl.dev}/include/openssl";
 
   buildInputs = [bzip2 zlib newt newt openssl pkgconfig slang
     # automake autoconf libtool gettext

pkgs/tools/filesystems/netatalk/default.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec{
 
   configureFlags = [
     "--with-bdb=${db}"
-    "--with-openssl=${openssl}"
+    "--with-openssl=${openssl.dev}"
     "--with-lockfile=/run/lock/netatalk"
     "--localstatedir=/var/lib"
   ];

pkgs/tools/filesystems/xtreemfs/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
     export BOOST_INCLUDEDIR=${boost.dev}/include
     export BOOST_LIBRARYDIR=${boost.out}/lib
-    export OPENSSL_ROOT_DIR=${openssl}
+    export OPENSSL_ROOT_DIR=${openssl.dev}
 
     substituteInPlace cpp/cmake/FindValgrind.cmake \
       --replace "/usr/local" "${valgrind}"

pkgs/tools/networking/curl/7.15.nix

@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
       "--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt"
-      ( if sslSupport then "--with-ssl=${openssl}" else "--without-ssl" )
+      ( if sslSupport then "--with-ssl=${openssl.dev}" else "--without-ssl" )
       ( if scpSupport then "--with-libssh2=${libssh2.dev}" else "--without-libssh2" )
     ]
     ++ stdenv.lib.optional c-aresSupport "--enable-ares=${c-ares}"

pkgs/tools/networking/curl/default.nix

@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
       "--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt"
       "--disable-manual"
-      ( if sslSupport then "--with-ssl=${openssl}" else "--without-ssl" )
+      ( if sslSupport then "--with-ssl=${openssl.dev}" else "--without-ssl" )
       ( if scpSupport then "--with-libssh2=${libssh2.dev}" else "--without-libssh2" )
       ( if ldapSupport then "--enable-ldap" else "--disable-ldap" )
       ( if ldapSupport then "--enable-ldaps" else "--disable-ldaps" )

pkgs/tools/networking/mailsend/default.nix

@@ -20,7 +20,7 @@ stdenv.mkDerivation {
     inherit (s) url sha256;
   };
   configureFlags = [
-    "--with-openssl=${openssl}"
+    "--with-openssl=${openssl.dev}"
   ];
   meta = {
     inherit (s) version;

pkgs/tools/networking/sstp/default.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     '';
 
   configureFlags = [
-    "--with-openssl=${openssl}"
+    "--with-openssl=${openssl.dev}"
     "--with-runtime-dir=/run/sstpc"
     "--with-pppd-plugin-dir=$(out)/lib/pppd"
   ];

pkgs/tools/networking/stunnel/default.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ openssl ];
   configureFlags = [
-    "--with-ssl=${openssl}"
+    "--with-ssl=${openssl.dev}"
     "--sysconfdir=/etc"
     "--localstatedir=/var"
   ];

pkgs/tools/networking/uwimap/default.nix

@@ -18,13 +18,13 @@ stdenv.mkDerivation {
     ++ stdenv.lib.optional (!stdenv.isDarwin) pam;
 
   patchPhase = ''
-    sed -i src/osdep/unix/Makefile -e 's,/usr/local/ssl,${openssl},'
+    sed -i src/osdep/unix/Makefile -e 's,/usr/local/ssl,${openssl.dev},'
     sed -i src/osdep/unix/Makefile -e 's,^SSLCERTS=.*,SSLCERTS=/etc/ssl/certs,'
     sed -i src/osdep/unix/Makefile -e 's,^SSLLIB=.*,SSLLIB=${openssl.out}/lib,'
   '';
 
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isDarwin
-    "-I${openssl}/include/openssl";
+    "-I${openssl.dev}/include/openssl";
 
   installPhase = ''
     mkdir -p $out/bin $out/lib $out/include

pkgs/tools/networking/vtun/default.nix

@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = ''
     --with-lzo-headers=${lzo}/include/lzo
-    --with-ssl-headers=${openssl}/include/openssl
-    --with-blowfish-headers=${openssl}/include/openssl'';
+    --with-ssl-headers=${openssl.dev}/include/openssl
+    --with-blowfish-headers=${openssl.dev}/include/openssl'';
 
   meta = with stdenv.lib; {
       description = "Virtual Tunnels over TCP/IP with traffic shaping, compression and encryption";

pkgs/tools/security/clamav/default.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     "--with-libbz2-prefix=${bzip2.dev}"
     "--with-iconv-dir=${libiconv}"
     "--with-xml=${libxml2}"
-    "--with-openssl=${openssl}"
+    "--with-openssl=${openssl.dev}"
     "--with-libncurses-prefix=${ncurses.dev}"
     "--with-libcurl=${curl.dev}"
     "--with-pcre=${pcre}"

pkgs/tools/security/duo-unix/default.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     [ "--with-pam=$(out)/lib/security"
       "--prefix=$(out)"
       "--sysconfdir=$(out)/etc/duo"
-      "--with-openssl=${openssl}"
+      "--with-openssl=${openssl.dev}"
       "--enable-lib64=no"
     ];
 

pkgs/tools/system/monit/default.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl ] ++ stdenv.lib.optionals usePAM [ pam ];
 
   configureFlags = [
-    "--with-ssl-incl-dir=${openssl}/include"
+    "--with-ssl-incl-dir=${openssl.dev}/include"
     "--with-ssl-lib-dir=${openssl.out}/lib"
   ] ++ stdenv.lib.optionals (! usePAM) [ "--without-pam" ];
 

pkgs/top-level/perl-packages.nix

@@ -2569,7 +2569,7 @@ let self = _self // overrides; _self = with self; {
       url = "mirror://cpan/authors/id/T/TT/TTAR/${name}.tar.gz";
       sha256 = "b66fab514edf97fc32f58da257582704a210c2b35e297d5c31b7fa2ffd08e908";
     };
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl}/include";
+    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
     NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
     meta = with stdenv.lib; {
       homepage = https://metacpan.org/release/Crypt-OpenSSL-AES;
@@ -2586,7 +2586,7 @@ let self = _self // overrides; _self = with self; {
       url    = "mirror://cpan/authors/id/I/IR/IROBERTS/${name}.tar.gz";
       sha256 = "18vg2bqyhc0ahfdh5dkbgph5nh92qcz5vi99jq8aam4h86if78bk";
     };
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl}/include";
+    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
     NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
   };
 
@@ -2596,7 +2596,7 @@ let self = _self // overrides; _self = with self; {
       url = "mirror://cpan/authors/id/R/RU/RURBAN/${name}.tar.gz";
       sha256 = "12pirh1pj8lpvzcwj2if9i6dbr6a7s9g1zc7gzbd3v87d6mx0rdf";
     };
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl}/include";
+    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
     NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
   };
 
@@ -2607,7 +2607,7 @@ let self = _self // overrides; _self = with self; {
       sha256 = "5357f977464bb3a8184cf2d3341851a10d5515b4b2b0dfb88bf78995c0ded7be";
     };
     propagatedBuildInputs = [ CryptOpenSSLRandom ];
-    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl}/include";
+    NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
     NIX_CFLAGS_LINK = "-L${pkgs.openssl.out}/lib -lcrypto";
   };
 
@@ -2617,7 +2617,7 @@ let self = _self // overrides; _self = with self; {
       url = "mirror://cpan/authors/id/N/NA/NANIS/${name}.tar.gz";
       sha256 = "1s7zm6ph37kg8jzaxnhi4ff4snxl7mi5h14arxbri0kp6s0lzlzm";
     };
-    makeMakerFlags = "--libpath=${pkgs.openssl.out}/lib --incpath=${pkgs.openssl}/include";
+    makeMakerFlags = "--libpath=${pkgs.openssl.out}/lib --incpath=${pkgs.openssl.dev}/include";
     buildInputs = [ PathClass TryTiny ];
   };
 

pkgs/top-level/python-packages.nix

@@ -12031,7 +12031,7 @@ in modules // {
     buildInputs = with self; [ pkgs.swig2 pkgs.openssl ];
 
     preConfigure = ''
-      substituteInPlace setup.py --replace "self.openssl = '/usr'" "self.openssl = '${pkgs.openssl}'"
+      substituteInPlace setup.py --replace "self.openssl = '/usr'" "self.openssl = '${pkgs.openssl.dev}'"
     '';
 
     doCheck = false; # another test that depends on the network.